feat(workout): include host result contract in mobile kit

Record share/haptics and the denied/timeout/unavailable/error host result kinds in Android and iOS release metadata, and make mobile verification require them.

req: examples/006

req: host/002

docs/recipes/mobile-release.md

@@ -55,6 +55,9 @@ The generated manifest records:
 - cache policy: release-scoped HTML/CSS/runtime assets only;
 - offline truth policy: app-owned command/event/projection records, never DOM
   patches or UI effect payloads;
+- host capability policy: Android and iOS shell metadata declare share/haptics and
+  the same denied, timeout, unavailable, and error result kinds handled by app
+  code before UI effects;
 - environment/secrets boundary: public shell config in the kit, signing secrets
   outside the repo;
 - rollback: redeploy the previous server binary and rebuild store artifacts from
@@ -76,4 +79,5 @@ reviewed without guessing what is still external. req: examples/006
 This is not a `hemx-mobile` framework, sync layer, client database, or native UI
 runtime. The mobile shells load the production Workout web app and route host
 capabilities such as share/haptics through the typed host boundary before UI
-effects are produced. req: host/002 req: local/002
+effects are produced; denied, timeout, unavailable, and error cases share the
+same host result shape. req: host/002 req: local/002